CVE-2026-44735

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.2 OpenProject versions prior to 17.4.0

Description An authorization flaw exists where the 'GET /api/v3/shares' endpoint returns share details for all work packages within a project to any user possessing the view shared work packages permission. The system performs authorization checks only at the project level and fails to verify if the requesting user has permission to view each individual shared work package. This allows project members to discover work package IDs, subjects, and the role levels (Editor, Commenter, Viewer) assigned to other users.

Recommendations Update to version 17.3.2. Update to version 17.4.0.